Anthropic Says Claude Mythos Preview Found HAWK-256 Key-Recovery Attack and Faster Reduced-Round AES Method
Summary
Anthropic says Claude Mythos Preview helped derive a HAWK-256 key-recovery attack using a hidden lattice symmetry and sped up a seven-round AES-128 attack 200–800x; both remain impractical, and HAWK-256 is a challenge parameter.
Key points
- Anthropic says the HAWK-256 attack uses an additional lattice automorphism, followed by lattice reduction and sieving, to recover functionally equivalent signing material.
- Anthropic’s released implementation reportedly recovered a usable HAWK-256 signing key in about 3 hours and 42 minutes on a 96-core server; it does not recover the original secret-key seed.
- The code targets HAWK-256, a challenge parameter, not the HAWK-512 or HAWK-1024 NIST security-level parameter sets, which Anthropic says remain impractical to attack.
- For seven-round AES-128, Anthropic says its Möbius Bridge fingerprint removes a 256-way guessing step, making the attack 200–800 times faster.
- The AES attack still requires an impractical number of chosen plaintexts. Anthropic projected full attack costs from component measurements and did not run complete key recovery against AES-128.
- Anthropic says Mythos Preview conducted much of the research, while researchers spent several hundred hours checking the results; the article reports no independent reproduction of the HAWK-256 recovery.
- As of July 29, 2026, NIST still listed HAWK as a third-round candidate; the article says no response on possible parameter or security-claim changes was available.
Article Details
- Attack Vectors
- The reported HAWK-256 key-recovery attack exploits a hidden lattice symmetry, then uses lattice reduction and sieving to recover short vectors and reconstruct functionally equivalent signing material.
- The reported seven-round AES-128 attack improves a meet-in-the-middle method by using an invariant fingerprint to remove a 256-way guessing step; it still requires an impractical number of chosen plaintexts.
- Defensive Notes
- Anthropic said neither result affects production systems and that no production software needs to change.
- The HAWK recovery code supports only HAWK-256, a challenge parameter; the article says the larger HAWK-512 and HAWK-1024 parameter sets remain impractical to attack.
- The AES result applies to seven of AES-128's ten rounds and does not demonstrate a complete recovery against real seven-round AES-128.
People
Daniël van GentCo-authored work showing that a nontrivial automorphism in the HAWK lattice could reduce key recovery to finding a short vector in a lower-dimensional lattice.Ludo PullesCo-authored work showing that a nontrivial automorphism in the HAWK lattice could reduce key recovery to finding a short vector in a lower-dimensional lattice.